Lucene search

Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

🗓️ 15 Oct 2024 18:02:00Reported by GitHub Advisory DatabaseType

Vendure asset server plugin allows local file read vulnerability and DOS via malformed URI, leading to sensitive data exposure and server crashe

Reporter	Title	Published	Views	Family All 10
Cvelist	CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202416:08	–	cvelist
Nuclei	Vendure - Arbitrary File Read	21 Oct 202412:16	–	nuclei
OSV	CVE-2024-48914	15 Oct 202416:15	–	osv
OSV	Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202418:00	–	osv
Vulnrichment	CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202416:08	–	vulnrichment
CVE	CVE-2024-48914	15 Oct 202416:15	–	cve
Veracode	Directory Traversal	24 Oct 202409:16	–	veracode
GithubExploit	Exploit for CVE-2024-48914	21 Oct 202410:02	–	githubexploit
NVD	CVE-2024-48914	15 Oct 202416:15	–	nvd
OpenVAS	Generic HTTP Directory Traversal (Web Dirs) - Active Check	22 Jul 202100:00	–	openvas

Vulners

Node

vendure asset-server-pluginRange3.0.0–3.0.5

vendure asset-server-pluginRange<2.3.3

Source	Link
github	www.github.com/vendure-ecommerce/vendure/security/advisories/GHSA-r9mq-3c9r-fmjq
github	www.github.com/vendure-ecommerce/vendure/commit/e2ee0c43159b3d13b51b78654481094fdd4850c5
github	www.github.com/vendure-ecommerce/vendure/commit/e4b58af6822d38a9c92a1d8573e19288b8edaa1c
github	www.github.com/vendure-ecommerce/vendure/blob/801980e8f599c28c5059657a9d85dd03e3827992/packages/asset-server-plugin/src/plugin.ts
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-48914
github	www.github.com/advisories/GHSA-r9mq-3c9r-fmjq

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

15 Oct 2024 18:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS39.1

EPSS0.001

SSVC